In fact the case referenced in the article ran into this. The image was recovered from unassigned space on the drive and therefore there was not even any data about where it came from (that could be faked too but at least it gives you something to disprove).